ceph: fix memory leaks in __ceph_sync_read()

commit d6fd6f8280f0257ba93f16900a0d3d3912f32c79 upstream.

In two `break` statements, the call to ceph_release_page_vector() was
missing, leaking the allocation from ceph_alloc_page_vector().

Instead of adding the missing ceph_release_page_vector() calls, the
Ceph maintainers preferred to transfer page ownership to the
`ceph_osd_request` by passing `own_pages=true` to
osd_req_op_extent_osd_data_pages().  This requires postponing the
ceph_osdc_put_request() call until after the block that accesses the
`pages`.

Cc: stable@vger.kernel.org
Fixes: 03bc06c7b0bd ("ceph: add new mount option to enable sparse reads")
Fixes: f0fe1e54cfcf ("ceph: plumb in decryption during reads")
Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index 3380d102a7965d9b535726218c8957d4d993a29b..8e0400d461a2a3658051bc9e14fca3c623e19fe3 100644 (file)
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -1127,7 +1127,7 @@ ssize_t __ceph_sync_read(struct inode *inode, loff_t *ki_pos,
 
                osd_req_op_extent_osd_data_pages(req, 0, pages, read_len,
                                                 offset_in_page(read_off),
-                                                false, false);
+                                                false, true);
 
                op = &req->r_ops[0];
                if (sparse) {
@@ -1193,8 +1193,6 @@ ssize_t __ceph_sync_read(struct inode *inode, loff_t *ki_pos,
                        ret = min_t(ssize_t, fret, len);
                }
 
-               ceph_osdc_put_request(req);
-
                /* Short read but not EOF? Zero out the remainder. */
                if (ret < len && (off + ret < i_size)) {
                        int zlen = min(len - ret, i_size - off - ret);
@@ -1226,7 +1224,8 @@ ssize_t __ceph_sync_read(struct inode *inode, loff_t *ki_pos,
                                break;
                        }
                }
-               ceph_release_page_vector(pages, num_pages);
+
+               ceph_osdc_put_request(req);
 
                if (off >= i_size || !more)
                        break;